Realtime dashboard seems to sum the results of the search

[bfeinberg]

I have a query like:

call summary | stats count as Total, count(eval(status=="failed")) as Failed | eval percent=(Total-Failed)/Total*100

I run this a dashboard query with 1h-rt as the start, and rt as the end. It seems like my results are being summed instead of giving me the the new percentage as derived above for each new sample set. What am I doing wrong, I assume its something easy.

[lguinn2]

A realtime dashboard panel will continue to accrue the data forever. If you want to just see the percentage over the last hour, use the same search but put the earliest=-1h and the latest=now (blank).

However, I think you also want this to be updated while the dashboard displays. You can't easily do that for a single dashboard panel, but you can do it for the dashboard overall.

Assuming that you are using the dashboard editor (or simple XML), edit the dashboard XML and look near the beginning for

<dashboard>

Change it to

<dashboard refresh="60">

Which will update the dashboard once each minute. This means that your search will be re-run automatically and a new percentage will be calculated.